Fix AccessMonitoringRule ACL (#43980)

Signed-off-by: Lisa Kim <[email protected]> Co-authored-by: Carlos Castro <[email protected]>
gravitational · Jul 10, 2024 · 95096dc · 95096dc
1 parent 988fea6
commit 95096dc
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/lib/services/useracl.go b/lib/services/useracl.go
@@ -150,6 +150,7 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 	dbAccess := newAccess(userRoles, ctx, types.KindDatabase)
 	kubeServerAccess := newAccess(userRoles, ctx, types.KindKubeServer)
 	requestAccess := newAccess(userRoles, ctx, types.KindAccessRequest)
+	accessMonitoringRules := newAccess(userRoles, ctx, types.KindAccessMonitoringRule)
 	desktopAccess := newAccess(userRoles, ctx, types.KindWindowsDesktop)
 	cnDiagnosticAccess := newAccess(userRoles, ctx, types.KindConnectionDiagnostic)
 	samlIdpServiceProviderAccess := newAccess(userRoles, ctx, types.KindSAMLIdPServiceProvider)
@@ -198,11 +199,9 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 
 	var auditQuery ResourceAccess
 	var securityReports ResourceAccess
-	var accessMonitoringRules ResourceAccess
 	if accessMonitoringEnabled {
 		auditQuery = newAccess(userRoles, ctx, types.KindAuditQuery)
 		securityReports = newAccess(userRoles, ctx, types.KindSecurityReport)
-		accessMonitoringRules = newAccess(userRoles, ctx, types.KindAccessMonitoringRule)
 	}
 
 	return UserACL{

diff --git a/lib/services/useracl_test.go b/lib/services/useracl_test.go
@@ -93,6 +93,7 @@ func TestNewUserACL(t *testing.T) {
 	require.Empty(t, cmp.Diff(userContext.Tokens, denied))
 	require.Empty(t, cmp.Diff(userContext.Nodes, denied))
 	require.Empty(t, cmp.Diff(userContext.AccessRequests, denied))
+	require.Empty(t, cmp.Diff(userContext.AccessMonitoringRule, denied))
 	require.Empty(t, cmp.Diff(userContext.ConnectionDiagnostic, denied))
 	require.Empty(t, cmp.Diff(userContext.Desktops, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.ExternalAuditStorage, denied))
@@ -152,6 +153,7 @@ func TestNewUserACLCloud(t *testing.T) {
 	require.Empty(t, cmp.Diff(userContext.Tokens, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.Nodes, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.AccessRequests, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.AccessMonitoringRule, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.DiscoveryConfig, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.ExternalAuditStorage, allowedRW))
 	require.Empty(t, cmp.Diff(userContext.Bots, allowedRW))